Detailed Privacy For Patients Policy

How the Suttons Medical Group uses your information to provide you with healthcare - Privacy Notice for Patients

This fair processing notice explains how the practice keeps your medical records confidential and complies with the General Data Protection Regulation (GDPR).

We hold your medical record so that we can provide you with safe care and treatment. We will also use your information so that the practice can check and review the quality of the care we provide. This helps us to improve our services to you. NHS health records may be electronic or on paper, usually a mixture of both and we use a combination of working practices and technology to ensure your information is kept confidential and secure.

Your GP practice records may include:

your address, date of birth and contact details
details of your appointments, home visits etc
notes about your health and any conditions or illnesses you might have
details about your treatment and care, including medications
results of investigations or tests
information from other healthcare providers

We will share relevant information from your medical record with other health or social care staff or organisations when they provide you with care. For example, your GP will share information when they refer you to a specialist in a hospital. Or your GP will send details about your prescription to your chosen pharmacy.

Healthcare staff working in A&E and out of hours care will also have access to your information. For example, it is important that staff who are treating you in an emergency know if you have any allergic reactions. This will involve the use of your Summary Care Record. For more information see: digital.nhs.uk/summary-care-records

The law requires The Suttons Medical Group to share information from your medical records in certain circumstances. Information is shared so that the NHS or Public Health England can, for example:

plan and manage services
check that the care being provided is safe
improve the quality and standard of care
prevent illness and infectious diseases from spreading
research into the development of new treatments

We will share information with NHS Digital, the Care Quality Commission and Public Health England when the law requires us to do so. Please see below for more information.

We must also share your information if a court of law orders us to do so.

You have the right to object to information being shared for your own care. Please speak to the practice if you wish to object. You also have the right to have any mistakes or errors corrected.

Other important information about how your personal data is used to provide your healthcare

NHS Digital

NHS Digital is a national body which has legal responsibilities to collect information about health and social care services.

It collects information from across the NHS in England and provides reports on how the NHS is performing. These reports help to plan and improve services to patients

This practice must comply with the law and will send data to NHS Digital, for example, when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012.

More information about NHS Digital and how it uses information can be found at:

Understanding the health and care information we collect - NHS Digital

All patients who receive NHS care are registered on a national database.

This database holds your name, address, date of birth and NHS Number but it does not hold information about the care you receive.

The database is held by NHS Digital

Telephone NHS Digital on: 0300 303 5678

NHS Digital sometimes shares names and addresses of patients suspected of committing immigration offences with the Home Office.

Public Health

The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population.

We will report the relevant information to local health protection team or Public Health England.

For more information about Public Health England and disease reporting see: www.gov.uk/guidance/notifiable-diseases-and-causative-organisms-how-to-report

Care Quality Commission (CQC)

The CQC regulates health and social care services to ensure that safe care is provided.

The law says that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.

For more information about the CQC see: www.cqc.org.uk

National screening programmes

The NHS provides national screening programmes so that certain diseases can be detected at an early stage.

These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms, diabetic eye screening service and NHS health checks.

The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme.

More information can be found at: www.gov.uk/topic/population-screening-programmes

NHS health checks are carried out by the practice, anonymized data is processed by by Health Intelligence Ltd on behalf of the practice.

Safeguarding

Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm.

These circumstances are rare.

We would follow strict practice protocols and procedures in the event we needed to do this and would take professional advice from appropriate agencies.

We do not need your consent or agreement to do this.

Please see Lincolnshire wide policies for more information:

www.lincolnshire.gov.uk/lsab - Adult safeguarding information

www.lincolnshire.gov.uk/safeguarding/lscp - Safeguarding children information

Third Party Processors

The practice may use carefully selected third party service providers. When a third party service provider is used to process data on behalf of the practice there will always be an appropriate agreement in place to ensure that data is kept secure, that information is only used or shared in accordance with our instructions and that the provider operates appropriately. Functions carried out by such third party providers may include:

Companies that provide IT services and support. This includes our core clinical system, EMIS, which uses a third party hosted environment provided by Amazon Web Services. Your data remains in the UK at all times and is fully encrypted at all times.
iGPR Technologies Ltd assist us with responding to report requests relating to your patient data eg subject access requests from your or someone on your behalf such as solicitors or insurance companies. iGPR manages the process for us by reviewing and responding to requests in accordance with our general and specific instructions. Some queries may be referred back to your GP for further consideration.
Systems which manage patients facing services such as our website and services available via the website
Delivery services
Payment providers

Medicines Management

The Practice conducts Medicines Management reviews of medications prescribed or dispensed to its patients.

This review of prescribed medications ensures patients receive the most appropriate, up to date and cost-effective treatments.
This service is provided to local practices by Lincolnshire Integrated Medicines and Prescribing Service (LIMPS) via NHS Lincolnshire ICB

Population Health Management including Patient Stratification - for case finding and for commissioning purposes

NHS Lincolnshire ICB is working in collaboration with member General Practices, Lincolnshire County Council (the County Council) and the NHS Provider Trusts within Lincolnshire ICS to deliver a Population Health Management Programme including patient stratification for both case finding and commissioning purposes to support the Lincolnshire Population Health Management Strategy.

The focus of the strategy is to improve health outcomes through the use of segmentation, stratification and impact modelling to identify risk cohorts, design and implement targeted interventions to prevent ill-health, improve care and reduce unwarranted variation in outcomes.
Population health management is described by NHS England as the analysis and segmentation of the needs of a population and the design of clinical and other interventions to prevent illness or acute deterioration.
Participating organisations will be able to gain a complete understanding of their population and be proactively managing care based on that information.
PHM supports case finding of patients who are at a high risk of experiencing outcomes such as unplanned hospital admissions, that are simultaneously undesirable for patients; costly/ to the health service; and potential markers of low-quality care
The third party processor for PHM is Arden & GEM CSU

A small number of analytics specialists will have access to pseudonymised data. This means you cannot be identified and your anonymity is ensured

Your data will not leave the UK

Arden & GEM CSU is fully compliant with all necessary data protection legislation.

Once the work is complete, all data will be destroyed

Patients who have chosen not to share their data for these purposes will be excluded from the data extraction process.

Referrals Management

Lincolnshire Referral Facilitation Service (RFS) Privacy Statement:

The purpose of RFS is to support the referrals process and ensure that patients are cared for in the right setting at the right time. The service facilitates the patient referral process – from initial GP referral to first outpatient appointment. It supports the majority of routine and urgent GP referrals although there will be some ICB specific specialty exclusions – all 2ww and non-elective/emergencies are excluded from this service. Patients referred following receipt of advice and guidance will still be referred via RFS but will bypass the clinical peer review process.

Analytics and Research

Lincolnshire ICB works with Arden and GEM CSU to support the care and treatment of the Lincolnshire population.

A small number of analytics specialists will have access to pseudonymised data. This means you cannot be identified and your anonymity is ensured

Your data will not leave the UK

Arden & GEM CSU is fully compliant with all necessary data protection legislation.

Once the work is complete, all data will be destroyed

This Practice also contributes anonymous data to the Clinical Practice Research Datalink (CPRD)

Patients who have chosen not to share their data for these purposes will be excluded from the data extraction process.

CCTV

CCTV is installed at both surgery premises.

CCTV is used to ensure the security of the premises, crime prevention or detection
CCTV is used to protect the safety of our staff whilst at work
Signs are displayed warning patients and staff that CCTV equipment is installed
CCTV images are monitored by practice staff in a secure area
CCTV images are retained for a limited period

Images of patients would not be disclosed without consent except in circumstances when this can be justified in the public interest. Personal and health information would not be released in any case.

Checking the quality of care - national clinical audits

The Suttons Medical Group contributes to national clinical audits so that healthcare can be checked and reviewed.

Information from medical records can help doctors and other healthcare workers measure and check the quality of care which is provided to you.
The results of the checks or audits can show where hospitals are doing well and where they need to improve.
The results of the checks or audits are used to recommend improvements to patient care.
Data are sent to NHS Digital a national body with legal responsibilities to collect data.
The data will include information about you, such as your NHS Number and date of birth and information about your health which is recorded in coded form - for example the code for diabetes or high blood pressure.
We will only share your information for national clinical audits or checking purposes when the law allows.
For more information about national clinical audits see the Healthcare Quality Improvements Partnership website: https://www.hqip.org.uk/or telephone 020 7997 7370.
You have the right to object to your identifiable information being shared for national clinical audits. Please contact the practice if you wish to object.

Privacy Statement for Online/Video Consultations

By law, all organisations that use personal information (personal data) must provide a clear description of how it is used and provide any related information to ensure the processing is carried out lawfully and fairly. The additional information below only applies to the use of your information when you use our online/video consultation service.

‘During the course of an online or video consultation with a clinician from Suttons Medical Group information will be shared between the clinician and the patient.

All information will be held in confidence and its use is covered by the Data Protection Act 2018 as well as the NHS Care Record Guarantee, which governs how the NHS can use your data.

Information will only be used by and shared with those who have a legitimate need to access the information to provide health care. The only information to be recorded and captured is the medical outcome of the discussion, which will be included on the patient record.

NHS Digital have stated that it is acceptable to use video conferencing tools such as Skype, WhatsApp, Facetime as well as commercial products designed specifically for this purpose.

This Practice uses AccuRx for digital consultations, this application is approved by NHS Digital and endorsed by NHS Lincolnshire ICB.

Telephone Call Recording

Suttons Medical Group now has the facility to record incoming and outgoing telephone calls. The telephone system is supplied and supported by Premier Voice and Data Ltd. Recordings are encrypted and stored securely in the Cloud, hosted by Amazon Web Services.

When calling the surgery the automated answering message states that your call may be recorded, this information is also on the Practice website. If you do not wish a call to be recorded you must inform the clinician or staff member at the start of the call.

Sometimes, calls may not be recorded if there’s a technical fault with the telephony system

or a member of staff is using equipment which does not have the call recording function.

Calls will be recorded in order to:

Monitor, review and improve services and quality of care
Train, develop and manage staff
Prevent, detect and investigate allegations, complaints, claims and / or fraud relating to patients, other organisations or the Suttons Medical Group
Protect staff and patients

We do this in the interests of offering a safe, high quality service to our patients, being a good employer and to protect public funds.

Call recordings may form part of your medical record. Telephone consultation recordings with a GP or Practice Nurse will be summarized to your patient record at the end of the call.

Call recordings may be shared internally within the practice; this includes with team members, Managers and GPs. Call recordings will only be shared within the Practice for legitimate work purposes.

Generally, call recordings will be retained for up to 7 years from the date of creation.

If the recording is still available, you can request a digital copy of your conversation by contacting the Practice. However, call recordings may have been securely destroyed in accordance with the practice retention schedule as stated above.

**We are required by law to provide you with the following information about how we handle your personal data.**
Data Controller contact details	The Suttons Medical Group Long Sutton Medical Centre Trafalgar Square, Long Sutton Lincolnshire PE12 9HB Telephone: 01406 362081 Sutton Bridge Medical Centre Railway Lane, Sutton Bridge Lincolnshire PE12 9LP Telephone: 01406 350217
Data Protection Officer contact details	The Data Protection Officer for Lincolnshire GP Practices is: Judith Jordan, Arden & Gem Head of Integrated Governance AGEM DPO NHS Arden & Greater East Midlands Commissioning Support Unit Westgate House, Market Street Warwick CV34 4DE Email: agem.dpo@nhs.net Telephone: 0121 611 0730
Purpose of the processing	To give direct health care to individual patients. To ensure correct people are invited for screening and that those most at risk will be offered treatment To check and review the quality of care. (This is called audit and clinical governance). Compliance with legal obligations or court order
Lawful basis for processing	The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under Article 6 and 9 conditions of the GDPR as set out below: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’; and Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...” and when Article 6(1)(c)..’processing is necessary for compliance with a legal obligation to which the controller is subject…’ Healthcare staff will also respect and comply with their obligations under the common law duty of confidentiality, to protect your privacy at all times.
Recipient or categories of recipients of the processed data	The data may be shared with: healthcare professionals and employed staff in the practice; Other GPs NHS trusts/Foundation Trusts/private hospitals out of hours services; emergency services; diagnostic and treatment centres; Independent contractors including opticians, dentists and pharmacists Clinical Commissioning Group and Commissioning Support Unit Optum, Health Intelligence Ltd and CPRD Ambulance services; Education Service Community health services; Mental Health Services; Social Services; Local authorities Public Health England and national screening services; CQC or General Medical Committee NHS Digital and Health & Social Care Information Centre Voluntary organisations eg MacMillan The Police and Judicial Service
Right to access and correct	You have the right to access your medical record and have any errors or mistakes corrected. Sometimes it may not be possible to amend information however a statement can be added to your record to explain that a particular piece of information is not accurate. Please speak to a member of staff. We are not aware of any circumstances in which you will have the right to delete correct information from your medical record; although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view
Rights to object	You have the right to object to information being shared between those who are providing you with direct care. This may affect the care you receive – please speak to the practice. You are not able to object to your name, address and other demographic information being sent to NHS Digital. This is necessary if you wish to be registered to receive NHS care. You are not able to object when information is legitimately shared for safeguarding reasons. It is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm. There are very limited rights to object when the law requires information to be shared but government policy allows some rights to object NHS Digital – you have the right to object to information being shared with NHS Digital for reasons other than your own direct care. You can object to your information being used for research and planning. Visit: General Practice Data for Planning and Research (GPDPR) - NHS Digital or www.nhs.uk/your-nhs-data-matters NHS Digital sharing with the Home Office - There is no right of objection to NHS Digital sharing names and addresses of patients who are suspected of having committed an immigration offence. Public health - Legally information must be shared under public health legislation. This means that you are unable to object. Care Quality Commission - Legally information must be shared when the Care Quality Commission needs it for their regulatory functions. This means that you are unable to object. Court order - Your information must be shared if it ordered by a court. This means that you are unable to object. For national screening programmes: you can choose to no longer receive an invitation to a screening programme. See: Opting out of the NHS population screening programmes - GOV.UK (www.gov.uk)
Notification	The Data Protection Act 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which personal and sensitive data is processed. This information is publicly available on the Information Commissioners Office website www.ico.org.uk The Suttons Medical Group is registered with the ICO
Retention period	GP medical records will be kept in line with the law and national guidance. Information on how long records are kept can be found at: Records Management Code of Practice - NHS Transformation Directorate (england.nhs.uk) or speak to the practice.
Right to complain	You have the right to complain to the Information Commissioner’s Office. If you wish to complain follow this link ico.org.uk/global/contact-us or call the helpline 0303 123 1113
Data we get from other organisations	We receive information about your health from other organisations which may be involved in providing you with health and social care. For example, if you go to hospital for treatment or an operation the hospital will send us a letter to let us know what happens. This means your GP medical record is kept up-to date when you receive care from other parts of the health service.

**We are required by law to provide you with the following information about how we handle your personal data.**
Data Controller contact details	The Suttons Medical Group Long Sutton Medical Centre Trafalgar Square, Long Sutton Lincolnshire PE12 9HB Telephone: 01406 362081 Sutton Bridge Medical Centre Railway Lane, Sutton Bridge Lincolnshire PE12 9LP Telephone: 01406 350217
Data Protection Officer contact details	The Data Protection Officer for Lincolnshire GP Practices is: Judith Jordan, Arden & Gem Head of Integrated Governance AGEM DPO NHS Arden & Greater East Midlands Commissioning Support Unit Westgate House, Market Street Warwick CV34 4DE Email: agem.dpo@nhs.net Telephone: 0121 611 0730
Purpose of the processing	To give direct health care to individual patients. To ensure correct people are invited for screening and that those most at risk will be offered treatment To check and review the quality of care. (This is called audit and clinical governance). Compliance with legal obligations or court order
Lawful basis for processing	The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under Article 6 and 9 conditions of the GDPR as set out below: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’; and Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...” and when Article 6(1)(c)..’processing is necessary for compliance with a legal obligation to which the controller is subject…’ Healthcare staff will also respect and comply with their obligations under the common law duty of confidentiality, to protect your privacy at all times.
Recipient or categories of recipients of the processed data	The data may be shared with: healthcare professionals and employed staff in the practice; Other GPs NHS trusts/Foundation Trusts/private hospitals out of hours services; emergency services; diagnostic and treatment centres; Independent contractors including opticians, dentists and pharmacists Clinical Commissioning Group and Commissioning Support Unit Optum, Health Intelligence Ltd and CPRD Ambulance services; Education Service Community health services; Mental Health Services; Social Services; Local authorities Public Health England and national screening services; CQC or General Medical Committee NHS Digital and Health & Social Care Information Centre Voluntary organisations eg MacMillan The Police and Judicial Service
Right to access and correct	You have the right to access your medical record and have any errors or mistakes corrected. Sometimes it may not be possible to amend information however a statement can be added to your record to explain that a particular piece of information is not accurate. Please speak to a member of staff. We are not aware of any circumstances in which you will have the right to delete correct information from your medical record; although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view
Rights to object	You have the right to object to information being shared between those who are providing you with direct care. This may affect the care you receive – please speak to the practice. You are not able to object to your name, address and other demographic information being sent to NHS Digital. This is necessary if you wish to be registered to receive NHS care. You are not able to object when information is legitimately shared for safeguarding reasons. It is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm. There are very limited rights to object when the law requires information to be shared but government policy allows some rights to object NHS Digital – you have the right to object to information being shared with NHS Digital for reasons other than your own direct care. You can object to your information being used for research and planning. Visit: General Practice Data for Planning and Research (GPDPR) - NHS Digital Or: www.nhs.uk/your-nhs-data-matters NHS Digital sharing with the Home Office - There is no right of objection to NHS Digital sharing names and addresses of patients who are suspected of having committed an immigration offence. Public health - Legally information must be shared under public health legislation. This means that you are unable to object. Care Quality Commission - Legally information must be shared when the Care Quality Commission needs it for their regulatory functions. This means that you are unable to object. Court order - Your information must be shared if it ordered by a court. This means that you are unable to object. For national screening programmes: you can choose to no longer receive an invitation to a screening programme. See: Opting out of the NHS population screening programmes - GOV.UK (www.gov.uk)
Notification	The Data Protection Act 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which personal and sensitive data is processed. This information is publicly available on the Information Commissioners Office website www.ico.org.uk The Suttons Medical Group is registered with the ICO
Retention period	GP medical records will be kept in line with the law and national guidance. Information on how long records are kept can be found at: digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the practice.
Right to complain	You have the right to complain to the Information Commissioner’s Office. If you wish to complain follow this link ico.org.uk/global/contact-us or call the helpline 0303 123 1113
Data we get from other organisations	We receive information about your health from other organisations which may be involved in providing you with health and social care. For example, if you go to hospital for treatment or an operation the hospital will send us a letter to let us know what happens. This means your GP medical record is kept up-to date when you receive care from other parts of the health service.

Local Services